Virt-RSBAC一种防御云计算内部威胁的框架.PDFVIP

四川大学学报（工程科学版） / Virt-RSBAC: 一种防御云计算内部威胁的框架 1 1* 2 1 张 磊 ，陈兴蜀 ，刘 亮 ，任 益 （1.四川大学 计算机学院 网络与可信计算研究所，四川 成都 610065 ；2. 四川大学 电子信息学院，四川 成都 610065 ） 摘 要：针对来自云计算平台的内部威胁，为了保护云用户的隐私，缓减平台提供者的安全监控需求与用户 隐私之间的策略冲突，提出一种虚拟化环境下的特权控制框架Virt-RSBAC 。通过在虚拟机监视器（VMM ） 中添加特权控制和基于角色的资源隔离规则，实现对特权域管理权限的分离，简化对云用户的管理，借助 于创建相互信任的安全虚拟机（SVM ）为云平台提供者和云用户提供安全服务。最后，在Xen上实现了该 框架的原型，实验与分析表明该框架能够防止恶意管理员获取用户隐私并提供检测功能，对原有系统的性 能损耗在可接受范围内。 关键词：云计算; 隐私保护; 特权控制; RSBAC; VMM 中图分类号：TP309 文献标志码：A Virt-RSBAC: A Novel Framework to Mitigate Internal Threat of Cloud Computing 1 1* 2 1 ZHANG Lei , CHEN Xingshu , LIU Liang , REN Yi (1.Network and Trusted Computing Inst., College of Computer Sci., Sichuan Univ., Chengdu 610065,China; 2.College of Electronics and Info. Eng., Sichuan Univ., Chengdu 610065,China) Abstract: For the internal threat of cloud, a privilege control framework named Virt-RSBAC was presented in this paper to enhance privacy protection for cloud users, and mitigate the policy conflict between the demand of secu- rity monitoring of cloud provider and users’ privacy. By adding privilege control and resource isolation rules based on role in the virtual machine monitor (VMM), it implemented the separation of administrative of privileged do- main, and simplified the management of cloud users, Virt-RSBAC created a mutually trusted secure virtual ma- chine to provide security services for cloud platform providers and users. Finally, a prototype of the Virt-RSBAC framework based Xen was realized, the experiments showed that the framework can prevent malicious adminis- trator to get user pri